This is why the rule doesn't trigger
I see ... so the reason this gets thru is the following.
foreach my $p ($pms->{msg}->find_parts(qr/^(application|text)\b/)) {
... just looking for application|text is being too kind
that needs to be more broad in this case.
I'd be for checking any attachment kind when looking for anything
"executable"
....
Any plans to change this? It's obviously an area where the spammer
has found a way to work around the rule.
On Aug 13, 2006, at 9:52 PM, Robert Nicholson wrote:
Could it be because the use the following Content Type?
Content-Type: audio/x-wav; name="hwrs.exe"
disguising a .exe as a wav?
On Aug 13, 2006, at 5:17 PM, jdow wrote:
SpamAssassin is not an anti-virus tool.
{^_^}
----- Original Message ----- From: "Robert Nicholson"
<[EMAIL PROTECTED]>
Are you saying that 25_antivirus.cf doesn't have
MICROSOFT_EXECUTABLE in 3.11?
On Aug 13, 2006, at 3:10 PM, Loren Wilton wrote:
Because MICROSOFT_EXECUTABLE didn't hit on that message?
Because MICROSOFT_EXECUTABLE was a 2.x rule that was deleted in
3.0 and you are runing 3.1.1?
